A new and dangerous credential-stealing tool called OnyxC2 has emerged in the cybercrime underground, showing just how easy it has become for even low-skilled attackers to run a professional hacking operation. <\/p>\n
Sold as a complete package for $250 a month, the malware gives buyers everything they need to quietly drain login data from victims worldwide. What makes it stand out is the scale of what it targets: over 210 applications and browser extensions in one sweep.<\/p>\n
OnyxC2 is marketed like legitimate commercial software, complete with a web panel, a payload builder, tiered pricing, and refunds if a build gets flagged. <\/p>\n
For a monthly fee, buyers get a kit that steals browser credentials, password manager data, two-factor authentication codes, and crypto wallet information. The stolen data is shipped back through an encrypted channel, making it harder for security tools to catch in transit.<\/p>\n
Analysts at\u00a0Blackfog\u00a0identified the malware and published their findings in a report<\/a> shared with Cyber Security News (CSN), revealing the full scope of what OnyxC2 can do and how it evades detection. <\/p>\n The research team obtained live builds, ran them in sandbox environments, and confirmed that the tool is actively reaching live command-and-control infrastructure.<\/p>\n The malware is written in C++, using assembly code to bypass security rules at the system level. Each build is mutated before delivery to break antivirus signature detection, and the developer claims a 99% evasion rate. <\/p>\n Blackfog\u2019s tests confirmed this: both sample builds submitted to VirusTotal came back clean on first upload, with the malicious component still undetected as of May 30, 2026.<\/p>\n The damage potential is very real. One infected machine shown in the panel had already surrendered 55 saved passwords, 4,717 cookies, 719 autofill entries, credit card data, and a crypto wallet, all from a single host. <\/p>\n That kind of haul can unlock banking systems, business accounts, and cloud services in one shot.<\/p>\n The breadth of OnyxC2\u2019s target list sets it apart from simpler stealers. It reaches 37 Chromium-based browsers and 8 Gecko-based browsers, plus 95 Chromium and 14 Gecko extensions, including 6 dedicated two-factor authentication tools. Even accounts protected by 2FA are not safe from this threat.<\/p>\n The stealer also covers 5 password managers, 17 cryptocurrency wallets, 11 FTP clients, and 5 email clients. A stealer that grabs password manager data alongside active session cookies<\/a> can access accounts even after a victim changes their password. <\/p>\n The FTP and email targets push its reach beyond personal accounts and into business systems that finance and operations teams use every day.<\/p>\n Beyond credential theft, OnyxC2 bundles a full remote-access toolkit. Operators can use HVNC to control a hidden browser session, run a keylogger, take screenshots, and manage files remotely. <\/p>\n A reverse SOCKS5 proxy and a built-in Tor tunnel round out the toolkit, letting attackers route traffic anonymously.<\/p>\n OnyxC2 reaches victims through fake installer packages disguised as legitimate software downloads. The lures found by researchers included packages mimicking Fling-Standalone, FinePrint, SystemSettings, and fake Windows update files. <\/p>\n Each malicious archive is password-protected, helping it slip past automated scanning tools that must open files to inspect them.<\/p>\n Inside each fake archive is a two-file package built for DLL sideloading. The first file is a legitimately signed application that Windows trusts without question, and the second is a malicious DLL named to match a library the signed program loads at startup. <\/p>\n When the victim runs what looks like an installer, the trusted program unknowingly loads the attacker\u2019s code from the same folder.<\/p>\n The malicious DLL is bloated past 120 MB by mimicking a real NVIDIA graphics library, with genuine-looking exported function names embedded inside. <\/p>\n Many antivirus scanners skip large files to save time, and the actual payload sits encrypted inside, only decrypting at runtime. <\/p>\n Blackfog recommends enforcing anti-data-exfiltration controls<\/a> at the endpoint, blocking outbound data transfers at the point of theft rather than relying solely on file scanning.<\/a><\/p>\n Indicators of Compromise:-<\/strong><\/p>\n![\"OnyxC2](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEi03QAqe9O6GVAdJB9dgrb9hbvcfnf21CbihE5hNWcIGA-Y7PJOW5Hm7qSopjvAsK-y69FysI6kRE_6yA8bYjbzP_l4CO_EESGQM7C24T3OTXDt5Q0-Wk7Z4ZGwAqoRLd9OOo4hizrdHK6AQnksYGtxyXvh9wRZwt-ayDlK6uSgOB0Se6oOUD71lp-8_7g\/s16000\/OnyxC2%2520dashboard%2520harvest%2520totals%2520%28Source%2520-%2520Blackfog%29.webp?ssl=1\")
Hackers Use OnyxC2 Malware-as-a-Service<\/strong><\/h2>\n
![\"OnyxC2](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEg5DO3fzUF91gV4OZ0BChfarRjGUVb_26JHIDV9DvkyPwfW0AMCFwKygGQqlAee1oI8V4TCXF_A57jQLgw9oYHhN-cyWyVbZumfdVbu6-_s42tPx63gjUO2uqua8gDc0wO6vzeOVu-3RRKyfdTcGX1xlBureoxOdu0qGu7QKLFwTPqHoUNjJ1mrvslBCV0\/s16000\/OnyxC2%2520license%2520tiers%2520and%2520pricing%2520%28Source%2520-%2520Blackfog%29.webp?ssl=1\")
![\"OnyxC2](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEj3Fny7V5mDx6n6Sv3WGfyhFIoX5kDlKG7p6rUghrRKaNMwAnyjs_Axf0YavB225_saT_vhdYqfYzC2hd9mJeGsfFsZdecjayR-vd2m_coDVZCfQBOM4g6qzyyYxCGZYJFcW2fvPzNzcSdR9wV7gTYvQHTouM8Dq0slQi4miLQ1UvAX5sD0eWXRJPzEjBw\/s16000\/OnyxC2%2520builder%2520with%2520backend%2520path%2520%28Source%2520-%2520Blackfog%29.webp?ssl=1\")
Fake Installer Delivery and Evasion<\/strong><\/h2>\n